--- schema_version: "1" id: fc27b26d6cbd1d6a805741db90fee6ba631726dfbc22415831b38c28c49b8e28 title: Troubleshooting Auto-Response Messaging Components collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/messaging_troubleshoot_auto_response_components.md canonical_url: https://help.salesforce.com/s/articleView?id=service.messaging_troubleshoot_auto_response_components.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 9be6131908848aa6c595101acb697ad730d469df85ccc8f6a0c2bee0524a321a description: You can encounter error messages when sending an auto-response messaging component. products: - Service Cloud - Digital Engagement release: "264" --- # Troubleshooting Auto-Response Messaging Components You can encounter error messages when sending an auto-response messaging component. ### Required Editions
View supported editions.
Checkmark This article applies to: Enhanced In-App Chat, Enhanced Web Chat v1, Enhanced Web Chat v2, and Bring Your Own Channel
X icon This article doesn’t apply to: Enhanced WhatsApp, Enhanced Facebook Messenger, Standard and Enhanced SMS, Enhanced Apple Messages for Business, and Enhanced LINE channels
Error Message Solution 
Refused to frame 
‘<your auto-response URL>’ because 
it violates the following Content 
Security Policy directive: 
“frame-src ‘self’
 Add the auto-response URL as a CSP Trusted URL. If Display Configuration is set to Pop-Up Message, select Allow site for frame-src under CSP Directives.  Depending on the contents of the URL, check additional CSP directives. For example, if the web page is supposed to render images, select Allow site for img-src. 
Framing '<your auto-response URL>' violates the following Content Security Policy directive: "frame-ancestors 'self' <list of allowed origins>". The request has been blocked.
The page's settings blocked the loading of a resource (frame-ancestors) at <URL> because it violates the following directive: "frame-ancestors 'self' <origins>"
Refused to load <URL> because it does not appear in the frame-ancestors directive of the Content Security Policy.

To allow external sites to load a Visualforce page, survey, Experience Cloud site, or Salesforce Site in an inline frame, add the domain as a trusted domain for inline frames.

If you're hosting a Visualforce page in an inline frame, make sure that Enable clickjack protection for customer Visualforce pages with standard headers is deselected on the Session Settings Setup page.

If you’re hosting a survey in an iframe for a different domain than the parent page, make sure that you have the Salesforce Feedback Management license.

If you're hosting a Salesforce site in an inline frame, make sure that Allow framing of site pages on external domains (good protection) or Allow framing by any page (no protection) is selected for the clickjack protection level on the Site Edit Setup page. For more information, see Salesforce Sites Implementation Guide: Create and Edit Salesforce Sites.

 
Refused to display 
‘<your auto-response URL>’ in a 
frame because it set 
‘X-Frame-Options’ to ‘sameorigin’.
 The auto-response URL can’t be loaded in an iframe. The owners of the web page and its HTTP headers control this configuration. If your deployment lives on an external website, fix it on the external website, not in Salesforce. If your deployment lives on a VisualForce page, the workaround is to downgrade Clickjack protection and remove Visualforce-specific instructions. 
Blocked form submission to 
‘<your auto-response URL>’ because 
the form's frame is sandboxed 
and the 'allow-forms' permission 
is not set

Opt out of applying iframe restrictions on the client side by adding this snippet to your code snippet (external website) or your <head> markup (Experience site):

embeddedservice_bootstrap.settings.omitSandbox = true;

You typically see this error message when trying to show a pop-up message auto-response on a website with functionality that’s restricted in our top-level container iframe. Setting the flag to true removes all restrictions from the container iframe. Security implications apply to recommending this workaround. When you bypass other security restrictions that sandboxing prevents, your web page for a pop-up message auto-response can become vulnerable to malicious code.